Four-Dimensional gallant-lambert-vanstone scalar multiplication

  • Authors:
  • Patrick Longa;Francesco Sica

  • Affiliations:
  • Microsoft Research;Nazarbayev University, Kazakhstan

  • Venue:
  • ASIACRYPT'12 Proceedings of the 18th international conference on The Theory and Application of Cryptology and Information Security
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

The GLV method of Gallant, Lambert and Vanstone (CRYPTO 2001) computes any multiple kP of a point P of prime order n lying on an elliptic curve with a low-degree endomorphism Φ (called GLV curve) over $\mathbb{F}_p$ as $kP = k_1P + k_2\Phi(P), \text{with } \max\{|k_1|,|k_2|\}\leq C_1\sqrt n$, for some explicit constant C10. Recently, Galbraith, Lin and Scott (EUROCRYPT 2009) extended this method to all curves over $\mathbb{F}_{p^2}$ which are twists of curves defined over $\mathbb{F}_p$. We show in this work how to merge the two approaches in order to get, for twists of any GLV curve over $\mathbb{F}_{p^2}$, a four-dimensional decomposition together with fast endomorphisms Φ, &Ψ over $\mathbb{F}_{p^2}$ acting on the group generated by a point P of prime order n, resulting in a proven decomposition for any scalar k∈[1,n] given by kP=k1P+k2Φ(P)+k3&Ψ(P)+k4&ΨΦ(P) with max i (|ki|)C2n1/4, for some explicit C20. Remarkably, taking the best C1, C2, we obtain C2/C1